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Distributing secret keys with information- 
theoretic security is arguably one of the most 
important achievements of the field of quantum 
information processing and communications [lj. 
The rapid progress in this field has enabled quan- 
tum key distribution (QKD) in real- world con- 
ditions [2l [3] and commercial devices are now 
readily available. QKD systems based on con- 
tinuous variables [4| present the major advantage 
that they only require standard telecommunica- 
tion technology, and in particular, that they do 
not use photon counters. However, these systems 
were considered up till now unsuitable for long- 
distance communication [5lTf]. Here, we over- 
come all previous limitations and demonstrate for 
the first time continuous-variable quantum key 
distribution over 80 km of optical fibre. The 
demonstration includes all aspects of a practi- 
cal scenario, with real-time generation of secret 
keys, stable operation in a regular environment, 
and use of finite-size data blocks for secret in- 
formation computation and key distillation. Our 
results correspond to an implementation guaran- 
teeing the strongest level of security for QKD re- 
ported to date for such long distances and pave 
the way to practical applications of secure quan- 
tum communications. 

Long-distance experiments in quantum information 
science, and in particular for quantum key distribution 
(QKD), are of utmost importance for future technologi- 
cal applications. Such experiments will allow the integra- 
tion of quantum devices in current secure infrastructures 
and in future networks based on quantum repeaters [8]. 
The quest for long-distance QKD in the last years has 
led to several successful demonstrations [5HT3]. however 
improving security guarantees and performance in practi- 
cal conditions in these implementations remains an issue. 
These experiments use discrete-variable or distributed- 
phase-reference protocols [T], where the key information 
is encoded on properties of single photons. Alternatively, 
in the so-called continuous-variable (CV) QKD proto- 
cols [1], light carries continuous information such as the 
value of the quadrature of a coherent state. Such pro- 
tocols have been implemented in a great variety of situ- 
ations [SHU IHHT^] . Their key feature is that dedicated 



photon-counting technology can be replaced by homo- 
dyne detection techniques that are widely used in clas- 
sical optical communications. Furthermore, recent re- 
sults suggest that these systems will be compatible with 
standard wavelength division multiplexed telecommuni- 
cation networks jSUj. Despite these attractive features, 
CVQKD schemes require complex post-processing pro- 
cedures, mostly related to error correction. These have 
hindered their operation over more than 25 km of opti- 
cal fibre [5]-[7], a communication span that may be in- 
sufficient for network cryptographic applications. Fur- 
thermore, implementations so far were based on security 
proofs valid in the asymptotic limit of infinitely large 
data blocks, while the finite size of real data must be 
taken into account according to more complete security 
proofs [3TH23]. 

Here we demonstrate the distribution of secret keys 
over a distance of 80 km, using continuous variables and 
security proofs compatible with the use of data blocks of 
finite size for the generation of the secret key. This re- 
markable range improvement was made possible by a sys- 
tem operation in a regime of signal-to-noise ratios (SNR) 
between one and two orders of magnitude lower than in 
earlier implementations. In fact, it was previously over- 
looked that techniques developed for error correction of 
Gaussian signals [23J can perform very close to the opti- 
mal bounds for very low SNR. Implementing such error- 
correction codes at high speed and in an optical envi- 
ronment featuring excellent stability hence enabling the 
acquisition of large data blocks, allowed us to reach pa- 
rameter regions that were previously inaccessible. This 
was a key element for the present experiments. 

In the experimental setup, shown in Figure [l] we im- 
plement the standard GG02 coherent-state continuous- 
variable QKD protocol described in [25]. The sender, 
Alice, prepares coherent states with a Gaussian modula- 
tion and sends them to the receiver, Bob, who measures 
either one of the quadratures with a homodyne detec- 
tion system. A reverse reconciliation scheme, in which 
Alice and Bob use Bob's data to establish the secret key 
[13] . is used. In practice, coherent light pulses with a 
duration of 100 ns and a repetition rate of 1 MHz are 
generated by a 1550 nm laser diode and split into a weak 
signal and a strong local oscillator (LO), which provides 
the required phase reference. The signal pulses are then 
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FM: Faraday Mirror 
PIN: PIN photodiode 
PM: Phase Modulator 
AM: Amplitude Modulator 
VATT: Variable Attenuator 
PBS: Polarization Beam Splitter 
DPC: Dynamic Polarization Controller 



Figure 1: Optical layout of the long-distance CVQKD prototype. Alice sends to Bob 100 ns coherent light pulses generated 
by a 1550 nm telecom laser diode pulsed with a frequency of 1 MHz. These pulses are split into a weak signal and a strong 
local oscillator (LO) with an unbalanced coupler. The signal pulse is modulated with a centered Gaussian distribution using an 
amplitude and a phase modulator. The variance is controlled using a coarse variable attenuator and the amplitude modulator. 
The signal pulse is 200 ns delayed with respect to the LO pulse using a 20 m delay line and a Faraday mirror. Both pulses are 
multiplexed with orthogonal polarization using a polarizing beamsplitter (PBS). The time and polarization multiplexed pulses 
are then sent through the channel. They are demultiplexed on Bob's side with another PBS combined with active polarization 
control. A second delay line on Bob's side allows for time superposition of signal and LO pulses. After demultiplexing, the 
signal and LO interfere on a shot-noise limited balanced pulsed homodyne detector. A phase modulator on the LO path allows 
for random choice of the measured signal quadrature. 



randomly modulated in both quadratures using an am- 
plitude and a phase modulator, and transmitted together 
with the LO pulses in a single fibre using time and po- 
larization multiplexing techniques. At the receiver's side, 
the pulses interfere on a homodyne detector, whose out- 
put is proportional to the signal quadrature selected by 
a phase modulator placed at Bob's local oscillator path. 
Due to a highly improved design with respect to previ- 
ous implementations, the setup presents an excellent sta- 
bility, ensured by several feedback controls. Polarization 
drifts occurring in the quantum channel are compensated 
using a dynamic polarization controller. The beamsplit- 
ter placed at the entrance of Bob's apparatus aims at 
generating from the LO pulse a clock signal that is inde- 
pendent of the polarization state. Then, the homodyne 
detection statistics and an appropriate algorithm allow 
us to maintain an optimal polarization state at the out- 
put of the channel. The photodiode on Alice's signal 
path is used for amplitude modulator feedback to cor- 
rect alterations of the required voltage settings induced 
by temperature variations, while the homodyne detection 
output provides the feedback for the phase modulators. 

The security of the implemented protocol is well estab- 
lished against collective attacks, both in the asymptotic 
and in the finite-size regime [551 US]- Moreover, 
collective attacks are shown to be asymptotically opti- 



mal, thanks, for instance, to an infinite-dimensional ver- 
sion of dc Finetti's theorem or to an adaptation of 
the so-called postselection technique [30 to continuous- 
variable protocols [31j . Security proofs combining arbi- 
trary attacks and finite-size effects are presently actively 
studied [23 [31] ■ Here, we consider the security proofs 
pertaining to collective attacks [35J, taking also into ac- 
count finite-size effects. The Gaussian modulation used 
in the implemented protocol maximizes the mutual infor- 
mation between Alice and Bob, thus offering an optimal 
theoretical key rate against such attacks. However, it is 
hard to reconcile correlated Gaussian variables, especially 
at low signal-to-noise ratios, which are inherent in exper- 
iments over long distances. Indeed, the secure distance 
of previous demonstrations of fiber-based CVQKD [7| 
was limited to about 25 km because no efficient error- 
correction procedure was available at low SNR. Here, we 
use the multidimensional reconciliation protocol of [24] . 
which transforms a Gaussian channel into a virtual bi- 
nary modulation channel, with a capacity loss that is 
very low at low SNR. This enables the use of error- 
correction codes designed for the Binary Input Additive 
White Gaussian Noise Channel (BIAWGNC) whose typ- 
ical efficiencies for arbitrarily low SNR are of 0.95 ex- 
tracted bit per theoretically available bit [33] . This leads 
to a significant extension of the secure distance. 
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Let us now look at the parameters that are relevant for 
the extraction of the secret key. Due to the Gaussian op- 
timally theorem, Alice and Bob's two-mode state at the 
output of the quantum channel is fully characterized by 
Alice's modulation variance Va, the channel transmission 
T and the excess noise £, which is added by the channel. 
Both Va and £ are expressed in shot noise units. These 
parameters, together with the shot noise, are estimated 
in real time using a parameter estimation process, dur- 
ing which a fraction of the samples is randomly chosen 
and revealed. The other parameters used to compute an 
estimate of the secret information that can be extracted 
from the shared data, namely the electronic noise v e \ and 
the efficiency of the homodyne detection 77, are measured 
during a calibration procedure that takes place before 
the deployment of the system and that is assumed to be 
performed in a secure environment. Since we have access 
to high-efficiency error-correction codes only for specific 
values of the signal-to-noise ratio, the modulation vari- 
ance Va is adjusted in real time in order to be at all 
times as close as possible to the SNR corresponding to 
the threshold of an available code. When there are sev- 
eral codes available with Va in its allowed range (roughly 
between 1 and 10 shot noise units on Alice's side), the 
one corresponding to the higher key rate is chosen. 

The privacy amplification step allows us to extract 
the secret information from the identical strings shared 
by Alice and Bob after the error- correct ion procedure. 
In addition to the amount of data revealed during the 
error-correction step, we compute an upper bound on 
the eavesdropper's information on the corrected string for 
collective attacks in both the asymptotic regime, where 
all the experimental parameters are assumed to be known 
with an infinite precision, and in the finite-size regime, 
where the transmission and the excess noise are estimated 
over large data pulse sets (> 10 8 pulses). The stability of 
our system allows us to obtain a positive secret key rate 
at long distances in both regimes. 

Long-distance secret key generation results for the 
asymptotic and finite-size regimes are shown in Figure 
[5J Secret keys were produced by the experimental sys- 
tem at 25 km (5.0 dB losses), 53 km (10.6 dB losses), 
and 80.5 km (16.1 dB losses) of standard optical fibre. 
The key rate was computed during 24 hours at all dis- 
tances. A sifting procedure reveals 50% of the raw key 
for parameter estimation, while 50% of the optical pulses 
have also been discarded for shot noise estimation that 
is performed in real time. The fraction of light pulses 
effectively used for generating the key is thus 25 %. The 
failure probability of the error correction is roughly 10%, 
which corresponds to the amount of sifted key that is 
discarded. The error correction is performed using Low 
Density Parity Check (LDPC) codes with a Graphic Pro- 
cessing Unit (GPU) decoder, which features a speed of 
several Mbits/s [31]. The final secret key rates range 
from more than 10 kbits/s at 25 km to a few kbits/s at 
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Figure 2: Key rate produced by the system after error correc- 
tion and privacy amplification during 24 hours with a SNR of 
1.1 on Bob's side at 25 km (5.0 dB losses), a SNR of 0.17 at 
53 km (10.6 dB losses), and a SNR of 0.08 on Bob's side at 
80.5 km (16.1 dB losses). In red, the rate is calculated assum- 
ing an eavesdropper able to perform collective attacks in the 
asymptotic regime. This rate is also valid against arbitrary 
attacks. In green (resp. blue), the rate is calculated assuming 
an eavesdropper able to perform collective attacks taking into 
account finite-size effects with block size 10 9 (resp. 10 8 ) and 
security parameter e = 10 -10 . The odd shape of the curves 
results from the use of a small set of error-correcting codes 
optimized to perform data reconciliation in specific ranges 
of SNR. The homodyne detection is characterized by an effi- 
ciency r\ = 0.552, known with uncertainty Ar/ — 0.025, and an 
electronic noise variance v e i = 0.015, known with uncertainty 
Au e ( = 0.002. For comparison, previous state-of-the-art ex- 
perimental results are shown |5J[Bl[T7|: they are all restricted 
to distances below 25 km, and do not take finite-size effects 
into account. 

53 km and a few hundreds of bits/s at 80.5 km. 

The results corresponding to the finite-size regime are 
of particular interest because of their relevance for prac- 
tical applications. Indeed, obtaining an infinite precision 
in parameter estimation as required in the asymptotic 
case is, in practice, impossible. We can further eluci- 
date the results corresponding to the finite-size case by 
investigating the impact on the secret key rate of the 
uncertainty on the value of the excess noise. Figure [3] 
shows the experimental excess noise measured on blocks 
of size 10 s during 24 hours at a distance of 53 km. More- 
over, for each data point, a worst-case estimator of the 
excess noise compatible with the experimental data is in- 
dicated. The probability that the true value of the excess 
noise is underestimated by the estimator because of sta- 
tistical fluctuations is less than 10 -10 . For comparison, 
the worst-case estimator for a block size of 10 6 is also dis- 
played and is clearly incompatible with the extraction of 
a secret key rate, thus showing that a very large block size 
is required to achieve long-distance QKD. These results 
illustrate the significance of the excess noise estimation 
for system performance. They also confirm the excellent 
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Figure 3: Experimental excess noise measured during 24 
hours with a SNR of 0.17 on Bob's side. For this measure- 
ment we used 53 km of standard optical fibre corresponding 
to 10.6 dB losses. The red + correspond to measurements 
performed on blocks of size 10 8 , each one corresponding to 
roughly 6 minutes of data acquisition, and indicate the ex- 
perimental measured excess noise (lower point) as well as the 
worst-case estimator for the excess noise (upper point) com- 
patible with this data up to a probability of 10 -10 . This 
worst-case estimator is the value used to compute the secret 
key rate when finite-size effects are taken into account. For 
comparison, the green x correspond to the worst-case esti- 
mator if the estimation was performed on blocks of size 10 6 . 
The blue line indicates the maximal value of excess noise that 
allows for a positive secret key rate. Even without any exper- 
imental noise, no secret key could be extracted at 53 km with 
a parameter estimation on blocks of size 10 6 . 



stability of our system, since the excess noise maintains 
low values, even in this very low SNR regime required by 
the security proof, and with very large data blocks. 

We have demonstrated, for the first time, that long- 
distance quantum key distribution can be achieved with 
continuous variables, using only standard telecommuni- 
cation components. Furthermore, we obtain a positive 
secret key rate over long distances even when taking into 
account finite-size effects. This was made possible by 
exploring a parameter region, namely the region of low 
signal-to-noise ratios, which was entirely inaccessible in 
previous implementations. Our results correspond to a 
practical implementation guaranteeing the strongest level 
of security reported for QKD at such long distances and 
show that continuous-variable quantum key distribution 
can be useful in long-range secure quantum communica- 
tions and network cryptographic applications. 

To conclude, let us discuss possible further improve- 
ments of our implementation. The current repetition rate 
of 1 MHz can be increased by shortening the pulse dura- 
tion and the time-multiplexing period, as well as the ho- 
modyne detection data sampling period, using high speed 
and high precision data acquisition cards. Current error- 



correction techniques using CPUs can deal with raw key 
rates of up to 10 Mbits/s, and even better rates are possi- 
ble using multiple devices. However, a key rate limitation 
is imposed by the fact that both the sifting procedure 
and the multidimensional reconciliation scheme require 
transmitting a large amount of classical data between 
Alice and Bob, so increasing the optical rate too much 
would lead to the saturation of the network link. Finally, 
the ultimate secure distance that can be reached by our 
system is determined by the excess noise present in the 
setup, which sets a fundamental limit to the attainable 
system performance. In this respect, recent protocols 
using "noiseless amplification" |35j or its "virtual" im- 
plementation 36, 37J might be promising. 

METHODS 

Experimental details: Our experiment is a one-way 
implementation, where Alice sends to Bob coherent light 
pulses with a 100 ns duration and 1 MHz repetition 
rate generated by a 1550 nm pulsed telecom laser diode. 
These pulses are split into a weak signal and a strong 
local oscillator (LO) with an unbalanced coupler. The 
implemented protocol uses Gaussian modulation of co- 
herent states [35]: the signal is randomly modulated in 
both quadratures using an amplitude and a phase modu- 
lator. The signal pulses are then attenuated by a variable 
attenuator such that the signal power belongs to a range 
allowing to control the variance of the Gaussian distri- 
bution exiting Alice's device using a photodiode and an 
appropriate feedback algorithm. A second variable at- 
tenuator lowers the signal level to a few shot noise units. 

The signal and LO are then transmitted through the 
optical fibre without overlap using time and polarization 
multiplexing. Delay lines of 200 ns, composed of a 20-m 
single-mode fibre followed by a Faraday mirror, are used 
for the time multiplexing. Polarization multiplexing is 
achieved using polarization beam splitters (PBS). After 
demultiplexing, the signal and LO interfere on a shot- 
noise limited balanced pulsed homodyne detector (HD). 
The electric signal coming from the HD is proportional to 
the signal quadrature where <p is the relative phase 
between the signal and the LO, which can be controlled 
using the phase modulator on Bob's LO path according 
to the Gaussian protocol [25] . 

Feedback controls are implemented to allow for a sta- 
ble operation of the system over a large number of pulses 
(> 10 8 ). Polarization drifts occurring in the quantum 
channel are corrected using a dynamic polarization con- 
troller that finds an optimal polarization state at the out- 
put of the channel. The photodiode on Alice's signal path 
is used for the feedback control of Alice's amplitude mod- 
ulator. On Bob's side, the homodyne detection output is 
sensitive to phase and can be used to control Alice's and 
Bob's phase modulators. 
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Security conditions: The implemented protocol re- 
quires an exact Gaussian modulation, which is impossi- 
ble to achieve [23] . In practice, this is approximated by a 
truncated discretized modulation with parameters com- 
patible with a security proof against collective attacks. 
This is done with almost optimal randomness consump- 
tion using source coding techniques. 

The efficiency and the variance of the electronic noise 
of the homodyne detection are assumed to be calibrated 
in a secure laboratory. We evaluate confidence intervals 
for these values and we compute the eavesdropper's cor- 
responding information taking calibrated values uncer- 
tainties into account [2"3] . 

Multidimensional reconciliation: The error- 
correction step is divided into two parts. First, Bob di- 
vides his data into vectors y of size 8 and for each, draws 
a binary vector u of the same size at random; u is the 
reference for the key after the error correction. Then Bob 
computes r = y ■ u (where the vectors are interpreted as 
octonions, see [24] for details) and sends it to Alice who 
obtains v — a;" 1 • r — x" 1 ■ y ■ u, that is a noisy version of 
Bob's binary modulated vector u, with a noise close to a 
Gaussian noise. Interestingly, it can be shown that the 
classical data r, available to Eve, does not leak any infor- 
mation about the binary vector u [23]. The second step 
of the error-correction protocol consists in forming vec- 
tors of size 2 20 on Alice's and Bob's sides (corresponding 
to 2 17 pairs of such vectors u, v) and to use multi-edge 
LDPC codes to correct all the errors [33]. The amount of 
data revealed during this step is subtracted from the se- 
cret information previously computed. We use Graphics 
Processing Unit (GPU) decoding [34] to obtain a decod- 
ing speed compatible with real-time data-processing. 

Post-processing performance: The error- 
correction is performed using low-SNR multi-edge 
Low Density Parity Check (LDPC) codes [33]. High 
efficiencies are obtained when operating very close to 
the maximum amount of noise a code can correct. 
We achieve speeds up to several Mbits/s [33] using an 
OpenCL implementation of Belief Propagation with 
flooding schedule on an AMD Tahiti Graphics Proces- 
sor. The huge parallelism provided by GPUs allows 
to overcome the computational complexity of CVQKD 
pointed out in [35] , 

Puncturing and shortening of LDPC codes allow to 
modify the rate of a code while maintaining a high effi- 
ciency over a SNR range. We use a technique proposed in 
[39"] that consists in adapting the code rate with the sum 
of punctured and shortened bits equal to a constant value 
determined as the maximum number of punctured bits 
one can use with a given code without any significant 
efficiency loss (approximately 10% of the code length). 
This is particularly convenient since the input size of the 
error correction is constant; only the output size of the 
corrected key depends on the number of shortened bits. 

Privacy amplification is performed by multiplying 



by random Toeplitz matrices aggregated corrected key 
blocks. This can be done very efficiently with input 
blocks of size 10 9 : a throughput above 40 Mb/s is ob- 
tained with one core of a Core i7-920 processor for a rate 
of 10~ 3 secret key bit per raw key bit. 

Hardware stability: Hardware stability over a long 
period of time is necessary to extract secret keys from 
blocks of size greater than 10 9 , as is required to take into 
account finite-size effects for distances above 50 km |23j . 
A limitation to the long-term hardware stability in [5] [7] 
was the clock reliability on the receiver's side, because 
of its dependence on the polarization control. We use a 
splitter and a dedicated electronic circuit and obtain a 
considerably less noisy and hence more reliable clock. 
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